All articles tagged with #browser extensions
WIRED highlights five Chromium-based extensions—Improve YouTube, Enhancer for YouTube, PocketTube, Turn Off the Lights, and DeArrow—that enhance YouTube with UI tweaks, playback controls, subscription organization, screen dimming to reduce distractions, and crowdsourced improvements to video titles and thumbnails, all without focusing on ad blockers.
Two California-backed class-action lawsuits in the Northern District of California allege LinkedIn secretly scans users’ browsers to detect installed extensions and shares related data with third parties; LinkedIn says it discloses such extension scanning in its Privacy Policy to detect abuse and protect site stability, while the suits draw on the BrowserGate report and involve Teamfluence, seeking damages and an injunction.
Security researchers at LayerX disclosed 17 malicious browser extensions across Firefox, Chrome and Edge that were downloaded more than 840,000 times and could stay active for years. Mozilla and Microsoft have removed them from official stores; users who installed any should uninstall immediately. The GhostPoster campaign used steganography to hide code and delayed execution to cloak malicious actions, including rewriting HTTP headers, hijacking affiliate traffic, injecting scripts for click fraud and user tracking, auto-solving CAPTCHAs, and granting attackers extended control. Notable extensions included Google Translate in Right Click and Translate Selected Text with Google, with Urban VPN Proxy cited as another high-risk example.
Researchers identified 17 Chrome, Firefox, and Edge extensions linked to the GhostPoster campaign. The malware-monitored extensions hide a multi-stage payload that weakens browser protections, opens a backdoor for remote code execution, can hijack traffic and inject tracking scripts, and has reportedly remained active for years before being removed. If you already downloaded any of these extensions, delete them immediately.
Researchers warn of the GhostPoster campaign, which distributed 17 malicious browser extensions across Chrome, Firefox, and Edge to monitor activity and hijack affiliate traffic. The extensions load a remote payload via a logo-based loader, and together they have thousands to hundreds of thousands of installs (over 840k in total). Although these extensions can no longer be installed in major browsers, anyone who still has them should delete them immediately, as they can inject scripts, strip HTTP headers, bypass CAPTCHA, and enable click fraud; the campaign appears to have started as early as 2020.
Security researchers warn that 22 malicious browser extensions, hiding GhostPoster malware in their logos, have infected over 840,000 users across Chrome, Firefox and Edge since 2020. The extensions spy on activity, inject backdoor scripts, and redirect to fraudulent sites, with potential to install more malware. Mozilla and Microsoft removed the extensions, but affected users must uninstall them manually to stop further damage.
Researchers found 17 GhostPoster-linked extensions in Chrome, Firefox, and Edge totaling about 840,000 installs. The extensions hide malicious JavaScript in their logos to monitor browser activity, hijack affiliate links, and inject invisible iframes for ad and click fraud, pulling a heavily obfuscated payload from an external resource. LayerX reports a more advanced variant that moves the payload into the extension’s background script and stores it inside a bundled image, improving dormancy and evasion. Some extensions have been removed from Mozilla and Microsoft stores; Google has removed them from Chrome Web Store, but users who installed them may still be at risk. The campaign originated on Edge and later spread to other browsers, and the researchers say it remains active.
The DarkSpectre threat actor, linked to China, has exposed a series of malicious browser extensions across Chrome, Edge, and Firefox, affecting over 8.8 million users worldwide. These extensions, including ShadyPanda, GhostPoster, and The Zoom Stealer, are designed for data theft, corporate espionage, and meeting information harvesting, often masquerading as legitimate tools for video conferencing and utilities. The campaigns have been active for over seven years, with some extensions still in the trust-building phase, posing significant risks to user privacy and corporate security.
Research reveals that four popular browser extensions, including Urban VPN Proxy, have been secretly harvesting and transmitting users' AI chat conversations to third parties, despite privacy claims. These extensions inject scripts into AI platforms like ChatGPT and Meta AI, capturing and sending chat data without user consent, raising significant privacy concerns. Users are advised to uninstall these extensions immediately to protect their data.
Nearly 1 million browser extensions across Chrome, Firefox, and Edge have been exploited to covertly turn browsers into web scraping bots for a paid service, leveraging a JavaScript library called MellowTel-js. These extensions, used for various benign purposes, are being used to bypass security protections and scrape websites on behalf of paying clients, including advertisers, raising significant security concerns.
Researchers uncovered Meta's new tracking technique exploiting a loophole to spy on users' web browsing, bypassing security protections on Android devices. This highlights the ongoing privacy risks posed by Meta's surveillance practices. To protect yourself, use privacy-focused browsers like Brave or DuckDuckGo, delete untrusted apps, install privacy extensions like Privacy Badger, and limit Meta's data use. The incident underscores the need for stronger privacy laws and better browser protections, especially in Chrome, which currently lacks robust tracker blocking.
Google will begin phasing out Manifest V2 extensions in Chrome starting June 3, 2024, weakening ad blockers and other extensions. Manifest V3 aims to improve security, privacy, and performance but poses challenges for developers. Enterprises have until June 2025 to transition. Popular ad blockers like uBlock Origin are adapting, but users may face limitations. Google claims 85% of actively maintained extensions have migrated to Manifest V3.
Google Chrome is transitioning from its older Manifest V2 extension system to the more limited Manifest V3 starting next week, despite controversy and criticism from groups like the Electronic Frontier Foundation. Manifest V3 aims to improve security and privacy but restricts capabilities of extensions, particularly ad blockers. Firefox will support Manifest V3 for compatibility but will continue to support V2. Users may need to find alternatives or switch to Firefox as V2 extensions are phased out.
Google is moving forward with its plan to phase out Manifest V2 browser extensions, including ad-blockers, in favor of the newer Manifest V3. Starting Monday, users of Chrome's Beta, Dev, and Canary builds will see warnings about the impending deactivation of V2 extensions. While Manifest V3 aims to improve performance, privacy, and security, it has faced criticism for potentially reducing the effectiveness of content-blocking extensions. Google has made some concessions to developers, but the transition will be fully enforced by early 2025, with enterprises given until June 2025.
YouTube users with ad blockers report videos skipping to the end or muting, affecting both Chrome and Firefox users. The issue, which began recently, is resolved by disabling ad blockers. YouTube states ad blockers violate their Terms of Service and suggests using YouTube Premium for an ad-free experience. Workarounds include switching to uBlock Origin, using incognito mode, or trying the Brave browser.